Newsletters
Türkiye’s Cyber Security Presidency completed security checks on the country’s e-Government portal on Wednesday and found no issues affecting public services, after two critical vulnerabilities in Hypertext Preprocessor (PHP), the widely used website programming language, prompted temporary shutdowns worldwide.
The platform, which serves more than 69 million users, continues to operate without disruption as authorities carry out nationwide security scans launched Wednesday and urge public institutions and private companies to update their systems, the presidency said in a statement.
The vulnerabilities, known as "PHP2Shell," can allow attackers to execute malicious code remotely on affected servers without authentication under certain conditions, potentially exposing sensitive data and enabling unauthorized access.
The flaws affect PHP infrastructure widely used to run websites and online applications.
Turkish authorities have urged system administrators to review internet-facing systems, install security patches, and switch to secure software versions.
Organizations have also been asked to identify outdated components, restrict unnecessary external connections, and strengthen safeguards against unauthorized access.
The PHP development team has released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, urging users to update immediately. PHP 8.1 and older versions no longer receive official security updates, leaving users dependent on upgrades or patches from other software providers.
The vulnerabilities triggered disruptions across Europe and elsewhere on Wednesday, as operators moved to secure their systems. Affected services included government websites in Finland, Germany, France, Belgium and the Netherlands, as well as hospital websites and Wikimedia-hosted services.
Many of the shutdowns were precautionary, following cybersecurity guidance to isolate vulnerable systems until security patches could be applied.
The PHP development team acknowledged that one of the flaws was first identified in 2024, but efforts to fix it repeatedly stalled because of technical disagreements and a lack of resources. The team described the delay as a structural failure.
Set as preferred source
Set as preferred source
1 min read
1 min read
